Security
What you can rely on.
How Leaf Edge handles your broker access, your credentials, what Sage sends to a model, and your data rights, stated only where the code supports it. Reviewed 27 October 2026.
Your broker: read-only, by design
Leaf Edge reads your trades. It never places, changes or cancels an order, because no code path in the product can.
- A SnapTrade connection is authorised on your broker's own page, through SnapTrade. Your broker password never reaches Leaf Edge, and the connection Leaf Edge receives is requested read-only. Disconnect it any time from the account menu, or at your broker.
- An Interactive Brokers connection uses a Flex token and query IDs you create at IBKR. A Flex token is read-only and you can revoke it at IBKR at any time; Leaf Edge pulls a report only when you run Fast Sync or Full Sync.
- A statement file needs no connection at all. Every plan can import files, and the free plan imports nothing but files.
What we store, and how
The things you give us that could be used against you are the ones we protect hardest.
- Passwords are stored as bcrypt hashes, never as text, and a sign-in attempt always runs the full comparison so a wrong email takes as long as a wrong password.
- Email verification and password reset links are stored as hashes of the token, so a copy of the database cannot be used to verify an account or reset a password.
- Signing in with Google stores no Google token: Leaf Edge keeps only the identity it needs to recognise you.
- Broker credentials you give us, which today are your IBKR Flex token and query IDs and the per-user secret SnapTrade issues, are encrypted at rest with AES-256-GCM. Each value is bound to your user, its row and its field, so a value copied anywhere else fails to open.
- Card details never touch Leaf Edge. Stripe takes the card at checkout; outside the UK, Onelink, a Stripe service, is the merchant of record.
- Every response carries security headers: strict transport security, a refusal to be framed by other sites, and referrer and permissions policies. Traffic is encrypted in transit with TLS.
What Sage sends, and the rule it sends it under
Sage is a coach that reads your own records. It cannot read them without sending some of them to a model.
- To answer, Sage sends the trades, journal notes, playbooks and reviews it needs, through OpenRouter, to the model provider you have chosen or the default.
- Every request is sent with provider data collection denied, so it may only reach a provider that does not train on your data. A model with no complying provider fails with an error instead of falling back to one that trains.
- Sage has no memory between chats. Each answer rebuilds its grounding from your saved records, and nothing is sent that you did not put in Leaf Edge.
- We do not say your data never leaves Leaf Edge, because a request to a model is exactly that. The rule is about training, and it is enforced in code, not in a policy.
Your data is yours
Leaf Edge is operated by Auromind Ltd, company number 17036346, registered in England and Wales and based in Peterborough, as the data controller under UK GDPR.
- Export everything, your trades, notes, playbooks and settings, as one JSON file from Settings, on every plan.
- Delete your account from Settings. It is immediate and irreversible, and it erases your account and its records, so export first if you want a copy.
- We never sell your data. The services that process it for us, for payments, hosting, the database, email, error reports, usage statistics, broker connections and Sage, are named in the privacy policy, along with where they process it.
- Usage statistics count page views, feature use and page speed, without the text you type or the text on what you click. You can switch them off on the cookies page.
How we test, and what we do not have yet
A small company cannot buy trust with a badge. It can show its working.
- Billing, P&L arithmetic and imports run under automated tests before every release, and a release reaches a staging copy before production.
- Two adversarial sweeps of the app's data boundaries ran this year, in June and September, each followed by a release of fixes. Every data route is scoped to the signed-in user.
- Not yet: two-factor authentication, an external audit such as SOC 2 or ISO 27001, and a bug bounty. We would rather say so than imply them.
- Found something? Write to hello@auromind.co.uk, or use Report a bug in the account menu when you are signed in. Never send a password, an account number or a whole broker statement.
Privacy policy Cookies and usage statistics Terms of service Refund policy Risk disclaimer
Make it your workspace
Start with your own trades.
Import a statement. Open a trade. Bring the chart, your notes and your playbook into the same review.
Free plan · No card needed · CSV import on every plan